自上周起，undici 7.22.0存在一个CVE，请参阅 https://npmx.dev/package/undici/v/7.22.0，似乎只能通过将angular/build从 21.2.2降级到20.3.21来解决。

这对我的构建影响很大。除了等待之外，还有其他修复方法吗？

npm audit fix的输出：

undici  7.0.0 - 7.23.0
Severity: high
Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client - https://github.com/advisories/GHSA-f269-vfmq-vjvj
Undici has an HTTP Request/Response Smuggling issue - https://github.com/advisories/GHSA-2mjp-6q6p-2qxm
Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression - https://github.com/advisories/GHSA-vrm6-8vpv-qv8q
Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation - https://github.com/advisories/GHSA-v9p9-hfj2-hcw8
Undici has CRLF Injection in undici via `upgrade` option - https://github.com/advisories/GHSA-4992-7rv2-5pvq
Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS - https://github.com/advisories/GHSA-phc3-fgpg-7m6h
fix available via `npm audit fix --force`
Will install @angular/[email protected], which is a breaking change
node_modules/undici
  @angular/build  21.0.0-next.0 - 21.2.3
  Depends on vulnerable versions of undici
  node_modules/@angular/build

6 vulnerabilities (4 low, 2 high)

To address all issues possible (including breaking changes), run:
  npm audit fix --force

解决方案

你可以在你的 package.json 中覆盖该依赖，直到团队完成更新为止（下周，相关的PR已合并 https://github.com/angular/angular-cli/pull/32803）。